Re: [RFC PATCH 00/56] Dynamic mitigations

Nicolas Bouchinet
2025-10-16T10:31:56Z

Hi David,

> > > > On Wed, Oct 15, 2025 at 01:53:31PM +0000, Kaplan, David wrote:
> > > > > > If `root` is capable of setting `mitigations=off` via this interface,
> > > > > > doesn't that somewhat defeat the purpose of denying `/proc/kcore`
> > > > > > access in lockdown confidentiality mode? Assuming one is running on a
> > > > > > CPU with some form of side-channel memory read vulnerability (which they
> > > > > > very likely are), they can turn off all mitigations, then read kernel
> > > > > > memory via one of those exploits.
> > > > > >
> > > > > > There should be a one-way switch to allow denying all further writes to
> > > > > > this interface, so that once the system's mitigations are set properly,
> > > > > > any further attempts to change them until the next reboot can be
> > > > > > prevented.
> > > > > >
> > > > >
> > > > > That's a good idea, there could be a separate mitigation_lock file
> > > > > perhaps that once written to 1 denies any further changes.
> > > >
> > > > Wouldn't the enablement of lockdown mode effectively function as that
> > > > one way switch?
> > > >
> > >
> > > I'm not too familiar with lockdown mode, but that gets enabled (with
> > > right cmdline options) during boot right? I guess the question is
> > > would we want to allow any window for userspace to reconfigure things
> > > and then lock things down, or say that if you enable lockdown then
> > > this interface is completely disabled and you need to specify your
> > > mitigation options on the cmdline only.
> >
> > Yeah, I would say the latter, otherwise it defeats the point of lockdown
> > mode. Note that lockdown mode can also be enabled at runtime.
> >
>
> Ok. So that's using the security_locked_down() API presumably. And what reason would we want to check for? Should it be LOCKDOWN_DEV_MEM (since we're potentially leaking arbitrary memory)? Or a new lockdown reason?
>
> --David Kaplan

LOCKDOWN_DEV_MEM is an integrity reason and should not be used for this
scenario.
I'd rather like to add a new Lockdown reason in the confidentiality set,
maybe LOCKDOWN_CPU_MITIGATION ?

Thank's

Nicolas